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Amendments to the Claims 

This listing of claims will replace all prior versions and listings of claims in the application. 

Claim 1 (currently amended): A cryptographic method that can b e us e d in for a transaction 
for which whereby a first entity (A) generates, by means of an RS A private key a proof 
verifiable by a second entity ^ by means of an RSA public key associated with said private 
key, said public key comprising a first exponent (e) and a modulus (ft), the method 
comprising the steps of characteriz e d in that : 

generating a first element of proof at the first entit y, wherebv (A) gonoratos a first 
element of proof (x), a first calculation of said first element of proof is executable 
which, con s uming consid e rable resourc e s, can bo executed independently of the 
transaction; 

generating, at the first entity^ (A) generat e s a second element of proof ^ related to the 
first element of proof (x) and dependent on a common number (e) shared by the first 
and second entities specifically for the transaction, a second wherebv calculation of 
which said first element of proof consiunes few substantially less resources than the 
calculation of said first element of proof : and 

verifying, at the second entity (B) v e rifi e s that the first element of proof (x) is related 
through a relationship with a first power modulo the modulus (n) of a generic number 
(g) having a second exponent equal to a linear combination of all or at least part of the 
common mmiber (^ and of the first exponent (^ of the public key multiphed by the 
second element of proof (j^. 

Claim 2 (currently amended): The cryptographic method as claimed in claim 1, charact e rized 
in that, to allow wherein for identifying the first entity^ (A) to be identifi e d: 
- the first element of proof (x) is generated by the first entity (A) by raising the generic 
number (^ to a second power modulo the modulus (h) having a third exponent equal to 
the first exponent (^ of the public key multiplied by a random integer (i^ kept secret by 
the first entit y, wherein {At^ 
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the common number (e) is chosen randomly from within a security interval [0,t 1] and 
then sent by the second entity (B) after having received the first element of proofs 
and wherein 

- the relationship verified by the second entity ^ is an equality relationship between a 
power of the first element of proof (x) and the first power of the generic number (g). 

Claim 3 (currently amended): The cryptographic method as claimed in claim 1, charact e rized 
in that, in ord e r to allow wherein for signing a message^ (M) to be signed: 

the first element of proof (x) is generated by the first entity (A) by applying a standard 
hash fimction to the message (M) and to the generic number (^ raised to a second 
power modulo the modulus (h) having a third exponent equal to the first exponent (e) 
of the public key multiplied by a random integer (f=) kept secret by the first entity.^ 
wherein (A)t 

the common number (e) is equal to the first element of proofs (5^)7 and wherein 
the relationship verified by the second entity (B) is an equality relationship between the 
first element of proof (x) and a result of the standard said hash fimction applied to the 
message ^4) and to the first power of the generic number (g). 

Claim 4 (currently amended): The cryptographic method as claimed in claim 1, oharactorized 
in that, in ord e r to allow wherein for authenticating that a message (M) received by the 
second entity (B) comes from the first entity^ (A^ 

the first element of proof (x) is generated by the first entity (A) by applying a standard 
hash fimction to the message (M) and to the generic number (g) raised to a second 
power modulo the modulus (n) having a third exponent equal to the first exponent (e) 
of the public key multiplied by a random integer (f) kept secret by the first entity^ 
wherein fA^ 

the common number (e) is chosen at random from within a security interval [0,t 1] and 
then sent by the second entity ^) after having received the first element of proofs (»)t 
and wherein 
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the relationship verified by the second entity (B) is an equality relationship between the 
first element of proof (x) and a result of the standard said hash function applied to the 
message (M) and to the first power of the generic number (g). 

Claim 5 (currently amended): The cryptographic method as claimed in ono of claims 2 to 
claim 4. wherein charact e rized in that: 

- the second element of proof ^ is generated by the first entity (A^ by subtracting, from 
the random integer the private key (^ multiplied by the common numbe r, wherein 

the linear combination equal to the second exponent comprises a positive imitary 
coefficient for the common number (e) and a positive unitary coefficient for the first 
exponent (e) of the public key multiplied by the second element of proof, (y^ and 
wherein. 

in the verified relationship, the first element of proof is considered with a unitary 
exponent power. 

Claim 6 (currently amended): The cryptographic method as claimed in eith e r of claims 2 and 
claim 4. characteriz e d in that: 

- since wherein the common nxmiber (o) is split into a comprises first clomontory 
common numb e r (a) and a second elementary common numb e r (b) numbers , 
wherein the second element of proof (j^ is generated by the first entity (A^ by 
subtracting, fi-om the random integer (f) multiplied by the first elementary common 
nxmiber (a), the private key (d) multiplied by the second elementary common number^ 

wherein the linear combination equal to the second exponent comprises a zero 
coefficient for the first elementary common number (a), a positive unitary coefficient 
for the second elementary common number (b) and a positive unitary coefficient for the 
first exponent (e) of the public key multiplied by the second element of proofs (y); and 

- and wherein, in the verified relationship, the first element of proof is considered with an 
exponent power equal to the first elementary common nimiber 
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Claim 7 (currently amended): The cryptographic method as claimed in either of claims 5 and 
claim 6, characterized in that wherein the second element of proof (^ is calculated modulo an 
image of the modulus (ft) via a Carmichael function (^ or modulo a multiple of the order of 
the generic number (g) modulo the modulus 

Claim 8 (currently amended): The cryptographic method as claimed in either of claims 5 and 
claim 6, characterizod in that wherein the random nimiber (i^ is v e ry much substantially 
greater than the value of the private key 

Claim 9 (currently amended): The cryptographic method as claimed in claim 7, charact e rized 
in that wherein the random integer (f) is less than an image of the modulus (n) via a 
Carmichael function (?t) or less than a multiple of the order of the generic number (g) modulo 
the modulus (ft). 

Claim 10 (currently amended): The cryptographic method as claimed in one of claims 5 to 9, 
charact e rized in that claim 9, wherein the third exponent is calculated modulo an image of the 
modulus via a Carmichael function (^ or modulo a multiple of the order of the generic 
number (^ modulo the modulus 

Claim 1 1 (currently amended): The cryptographic method as claimed in one of the preceding 
claims, characterized in that claim 1. wherein the generic nvunber (g) is transmitted with the 
public key, the generic number (g) being equal to a simple number (G) raised to a power 
modulo the modulus (ft) with the private key (d) as exponent. 

Claim 12 (currently amended): The cryptographic method as claimed in one of the preceding 
claims, charact e riz e d in that claim K further comprising the steps of : 
- receiving the second element of proof at a third entity; (C) r e c e ives the second elem e nt 
of proof (y), generates 

generating a third element of proof {¥) at the third entitv by raising the generic number 
(^ to a power modulo the modulus (ft) with the second element of proof ^ as 
exponent; and sends 
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sending the third element of proof (¥) to the second entity and 

- at the second entit y, raising (B), modulo th e modulus (n), raises the third element of 
proof (¥) to a power of first exponen t, modulo the modulus, (e) and multiplies 
multipl\dng the result thereof by the generic number (g) raised to a power whose 
exponent is the common number {e) in order to verify the relationship relating the first 
element of proof to the second element of proof. 

Claim 13 (currently amended): A prover device (30) provided with having an RSA private 
key kept secret and protected against intrusions, for generating, during a transaction with 
a verifier device, a proof whose verification by means of a public key associated with said 
private key molces it possibl e to guarant e e ensures that the said prover device (30) has 
originated said proof, said RSA public key comprising a first exponent (e) and a modulus (n); 
charact e riz e d in that it compris e s , the prover device comprising : 

calculation means (37) d e signed to generate for generating a first element of proof (x) 
completely or partly independently of the transaction and to generate a second element 
of proof iy) related to the first element of proof and dependent on a common number 
(e) specific to the transaction; and 

- communication means (3 4 ) d e signed to transmit for transmitting at least the first and 
second elements of proof and d e sign e d to transmit for transmitting said common 
number (e) to the verifier device or to rocoivo receiving said conraion number 
ther e firom fi-om the verifier device . 

Claim 14 (currently amended): The prover device (30) as claimed in claim 13, characteriz e d 
in that: 

- wherein the calculation means (37) are, on the one hand, designed to generate a first 
random number (f^ and to raise a generic number (g) to a second power modulo the 
modulus (n) having a third exponent equal to the first exponent (e) of the public key 
multiplied by the random integer (f); and 

- wherein the calculation means (37) are, on the other hand designed to generate the 
second element of proof (5^ by taking the difference between the random integer (f) 
and the private key (d) multiplied by the common number (e) o n where the common 
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number (o) b e ing is split into two elementary common nimibers (a, b) , by subtracting 
from the random integer multiplied by the first elementary common number (a), the 
private key (d) multiplied by the second elementary common nvtmber (b). 

Claim 15 (currently amended): The prover device (^ as claimed in claim 14, charact e riz e d 
m-fea t wherein the calculation means (^ are designed to carry out operations modulo an 
image of the modulus (a) via a Carmichael function (^ or modulo a multiple of the order of 
the generic number (g) modulo the modulus 

Claim 16 (currently amended): A verifier device (34) for verifying that a proof originates 
from a prover device provided with an RS A private key (d) kept secret by the prover device, 
by means of a public key associated with said private key, said RSA public key comprising 
an exponent (e) and a modulus (n\ characteriz e d in that it compris e G , the verifier device 
comprising : 

communication means (35) designed to receiv e for receiving a first element of proof (se) 
and a second element of proof (j^ or a third element of proof (¥), and to rec e iv e or 
transmit for receiving or transmitting a common number (e) specific to a transaction 
within which the first and the second or the third element of proof are received; and 
calculation means (3 8 ) designed to verify for verifying that the first element of proof 
(?e) is related through a relationship, modulo the modulus (ft), with a first power of a 
generic number (g) having a second exponent equal to a linear combination of all or at 
least part of the conunon number (e) and of the first exponent of the pubHc key 
multiplied by the second element of proof (j^. 

Claim 17 (currently amended): The verifier device (34) as claimed in claim 16, characteriz e d 
in that wherein the communication means are designed to receive the second element of proof 
(j^ and in that wherein the calculation means (38) are designed to calculate the second 
exponent and said first power of the generic number 

Claim 18 (cmrently amended): The verifier device (34) as claimed in claim 16, characterized 
in that wherein the communication means are designed to receive the third element of proof 
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(¥) and in that wherein the calculation means are designed to raise the third element of 
proof {¥) to a power of the first exponent (e) of the public key in order to multiply the result 
thereof by the generic number {g) raised to a second power having the common number (e) as 
exponent. 

Claim 19 (new): The cryptographic method as claimed in claim 2, wherein the second 
element of proof is generated by the first entity by subtracting, from the random integer, the 
private key multiplied by the common nimiber, wherein the linear combination equal to the 
second exponent comprises a positive unitary coefficient for the conmion nimiber and a 
positive unitary coefficient for the first exponent of the public key multiplied by the second 
element of proof, and wherein, in the verified relationship, the first element of proof is 
considered with a unitary exponent power. 

Claim 20 (new): The cryptographic method as claimed in claim 19, wherein the second 
element of proof is calculated modulo an image of the modulus via a Carmichael fimction or 
modulo a multiple of the order of the generic number modulo the modulus. 

Claim 21 (new): The cryptographic method as claimed in claim 20, wherein the random 
integer is less than an image of the modulus via a Carmichael fimction or less than a multiple 
of the order of the generic number modulo the modulus. 

Claim 22 (new): The cryptographic method as claimed in claim 19, wherein the third 
exponent is calculated modulo an image of the modulus via a Carmichael fimction or modulo 
a multiple of the order of the generic number modulo the modulus. 

Claim 23 (new): The cryptographic method as claimed in claim 3, wherein the second 
element of proof is generated by the first entity by subtracting, from the random integer, the 
private key multiplied by the common nvmiber, wherein the linear combination equal to the 
second exponent comprises a positive unitary coefficient for the common number and a 
positive unitary coefficient for the first exponent of the public key multiplied by the second 
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element of proof, and wherein, in the verified relationship, the first element of proof is 
considered with a unitary exponent power. 

Claim 24 (new): The cryptographic method as claimed in claim 23, wherein the second 
element of proof is calculated modulo an image of the modulus via a Carmichael function or 
modulo a multiple of the order of the generic number modulo the modulus- 
Claim 25 (new): The cryptographic method as claimed in claim 24, wherein the random 
integer is less than an image of the modulus via a Carmichael function or less than a multiple 
of the order of the generic nvmiber modulo the modulus. 

Claim 26 (new): The cryptographic method as claimed in claim 23, wherein the third 
exponent is calculated modulo an image of the modulus via a Carmichael function or modulo 
a multiple of the order of the generic number modulo the modulus. 

Claim 27 (new): The cryptographic method as claimed in claim 2, wherein the common 
number comprises first and second elementary common numbers, wherein the second 
element of proof is generated by the first entity by subtracting, firom the random integer 
multiplied by the first elementary common number, the private key multiplied by the second 
elementary common number, wherein the linear combination equal to the second exponent 
comprises a zero coefficient for the first elementary common nxmiber, a positive unitary 
coefficient for the second elementary common number and a positive unitary coefficient for 
the first exponent of the pubhc key muUiplied by the second element of proof, and wherein, 
in the verified relationship, the first element of proof is considered with an exponent power 
equal to the first elementary common number. 

Claim 28 (new): The cryptographic method as claimed in claim 27, wherein the second 
element of proof is calculated modulo an image of the modulus via a Carmichael function or 
modulo a multiple of the order of the generic number modulo the modulus. 
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Claim 29 (new): The cryptographic method as claimed in claim 28, wherein the random 
integer is less than an image of the modulus via a Carmichael function or less than a multiple 
of the order of the generic nxmiber modulo the modulus. 

Claim 30 (new): The cryptographic method as claimed in claim 27, wherein the third 
exponent is calculated modulo an image of the modulus via a Carmichael function or modulo 
a multiple of the order of the generic number modulo the modulus. 



13 



